Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

LDAP/Active directory authentication

Updated: April 17, 2026

Want to summarize with AI?

Log in

Describes an authentication method that allows network elements to retrieve AAA credentials from directory services for user authentication and authorization.

LDAP/Active Directory authentication is an authentication method that

  • allows network elements to retrieve AAA credentials for user authentication and authorization

  • functions similarly to RADIUS and TACACS+ protocols

  • supports certificate authority configuration to enable LDAPS (LDAP over SSL) trust and prevent man-in-the-middle attacks.

Configuration details

The XML example below configures the ACI fabric to work with an LDAP provider at IP address 10.30.12.128.

Note

While the examples provided here use IPv4 addresses, IPv6 addresses could also be used.

<aaaLdapProvider name="10.30.12.128" 
          rootdn="CN=Manager,DC=ifc,DC=com" 
          basedn="DC=ifc,DC=com" 
          SSLValidationLevel="strict" 
          attribute="CiscoAVPair" 
          enableSSL="yes" 
	    key="myldappwd"	
          filter="cn=$userid" 
          port="636" />
Note

For LDAP configurations, best practice is to use CiscoAVPair as the attribute string. If customer faces the issue using Object ID 1.3.6.1.4.1.9.22.1, an additional Object ID 1.3.6.1.4.1.9.2742.1-5 can also be used in the LDAP server.

Instead of configuring the Cisco AVPair, you have the option to create LDAP group maps in the APIC.

LDAP configuration

LDAP configuration is a network authentication setup process that

  • provides two distinct configuration options for APIC environments

  • supports either Cisco AVPair configuration or LDAP group map configuration within the APIC, and

  • enables directory-based authentication and authorization services.

Configuration options

You can choose between two LDAP configuration approaches:

  • Cisco AVPair configuration

  • LDAP group maps configuration in the APIC

Configure windows server 2012 LDAP for APIC access with Cisco AVPair

This task enables Windows Server 2012 LDAP authentication for Cisco Application Policy Infrastructure Controller (Cisco APIC) by adding the CiscoAVPair attribute to the Active Directory schema and configuring user permissions with appropriate RBAC roles.

LDAP integration with Cisco APIC requires the CiscoAVPair attribute to be configured in the Windows Server 2012 Active Directory schema. This attribute enables assignment of Cisco APIC roles to LDAP users for role-based access control.

Before you begin

  • First, configure the LDAP server, then configure the Cisco Application Policy Infrastructure Controller (Cisco APIC) for LDAP access.

  • The Microsoft Windows Server 2012 is installed and online.

  • The Microsoft Windows Server 2012 Server Manager ADSI Edit tool is installed. To install ADSI Edit, follow the instructions in the Windows Server 2012 Server Manager help.

  • CiscoAVPair attribute specifications: Common Name = CiscoAVPair, LDAP Display Name = CiscoAVPair, Unique X500 Object ID = 1.3.6.1.4.1.9.22.1, Description = CiscoAVPair, Syntax = Case Sensitive String.

    Note

    For LDAP configurations, best practice is to use CiscoAVPair as the attribute string. If customer faces the issue using Object ID 1.3.6.1.4.1.9.22.1, an additional Object ID 1.3.6.1.4.1.9.2742.1-5 can also be used in the LDAP server.

  • A Microsoft Windows Server 2012 user account is available that will enable the following:

    • Running ADSI Edit to add the CiscoAVPair attribute to the Active Directory (AD) Schema.

    • Configuring an Active Directory LDAP user to have CiscoAVPair attribute permissions.

  • Port 636 is required for configuring LDAP integration with SSL/TLS.

Follow these steps to configure Windows Server 2012 LDAP for APIC access with Cisco AVPair:

Procedure

  1. Log in to an Active Directory (AD) server as a domain administrator.

  2. Add the CiscoAVPair attribute to the AD schema.

    1. Navigate to Start > Run, type MMC and press Enter.
      The Microsoft Management Console (MMC) opens.
    2. Navigate to File > Add/Remove Sanp-in > Add.
    3. In the Add Standalonee Snap-in dialog box, select the Active Directory Schema and click Add.
      The MMC Console opens.
    4. Right-click the Attributes folder, select the Create Attribute option.
      The Create New Attribute dialog box opens.
    5. Enter CiscoAVPair for the Common Name, CiscoAVPair for the LDAP Display Name, 1.3.6.1.4.1.9.22.1 for the Unique X500 Object ID, and select Case Sensitive String for the Syntax.
    6. Click OK to save the attribute.

  3. Update the User Properties class to include the CiscoAVPair attribute.

    1. In the MMC Console, expand the Classes folder, right-click the user class, and choose Properties.
      The user Properties dialog box opens.
    2. Click the Attributes tab, and click Add to open the Select Schema Object window.
    3. In the Select a schema object: list, choose CiscoAVPair, and click Apply.
    4. In the MMC Console, right-click the Active Directory Schema, and select Reload the Schema.

  4. Configure the CiscoAVPair attribute permissions.

    Now that the LDAP includes the CiscoAVPair attributes, LDAP users need to be granted Cisco APIC permission by assigning them Cisco APIC RBAC roles.

    1. In the ADSI Edit dialog box, locate a user who needs access to the Cisco APIC.
    2. Right-click on the user name, and choose Properties.
      The <user> Properties dialog box opens.
    3. Click the Attribute Editor tab, select the CiscoAVPair attribute, and enter the Value as shell:domains = <domain>/<role>/,<domain>//role.

      For example, if the CiscoAVPair has a value of shell:domains = solar/admin/,common//read-all(16001) , then solar is the security domain, admin is the role for this user that gives write privileges to this user in the security domain called solar , common is the Cisco Application Centric Infrastructure (Cisco ACI) tenant common, and read-all(16001) is the role with read privileges that gives this user read privileges to all of the Cisco ACI tenant common.

    4. Click OK to save the changes and close the <user> Properties dialog box.

The LDAP server is configured to access the Cisco APIC.

What to do next

Configure the Cisco APIC for LDAP access.

Configure APIC for LDAP access

Configure APIC to use LDAP authentication for user access management.

LDAP configuration enables centralized authentication for APIC users through an external LDAP server.

Before you begin

  • The Cisco Application Centric Infrastructure (ACI) fabric is installed, Application Policy Infrastructure Controllers (APICs) are online, and the APIC cluster is formed and healthy.

  • The LDAP server host name or IP address, port, bind DN, Base DN, and password are available.

  • The APIC management endpoint group is available.

Procedure

  1. In the APIC, configure the LDAP Provider.

    For configuring an LDAP provider, see Create a provider.

    For toggling in-band or out-of-band management in the APIC GUI:

    In the Navigation pane, choose System > System Settings > APIC Connectivity Preferences. In the Work Pane select either inband or ooband.

  2. Create the Login Domain for LDAP.

    For the detailed procedure, see Create login domain using the GUI.

APIC is configured for LDAP authentication with the provider and login domain created.

What to do next

This completes the APIC LDAP configuration steps. Next, test the APIC LDAP login access.

Configure LDAP group map rules on the Cisco APIC

Configuring LDAP group map rules enables you to map LDAP groups to APIC security domains and roles for authentication and authorization purposes.

Configuring an LDAP group map on the Cisco APIC requires first creating LDAP group map rules. This section explains how to create LDAP group map rules.

Before you begin

An LDAP server is running with a configured group mapping.

Follow these steps to configure LDAP group map rules on the Cisco APIC:

Procedure

  1. On the menu bar, choose Admin > AAA.

  2. In the Navigation pane, choose Authentication.

  3. In the Work pane, choose LDAP Group Maps > LDAP Group Map Rules.

  4. Click the Actions button > Create LDAP Group Map Rule.

  5. In the Create LDAP Group Map Rule screen that is displayed, specify the Type, Group Map Rule Name, Description (optional), Group DN.

  6. In the Security Domains pane, click Add Security Domain. In the Security Domains pop-up window, enter the following details:

    1. Click Select Security Domain to select a security domain.
    2. Click Add Role to add a role and select a privilege from the drop-down list. Click the tick-mark to assign the selected privilege to the role. Repeat this step to add multiple roles to a security domain.
    3. Click Add on the Security Domains window.

  7. Click Save on the Create LDAP Group Map Rule screen.

Configure an LDAP group map on the Cisco APIC

This task creates an LDAP group map that enables LDAP-based authentication and authorization on the Cisco APIC.

This section explains how to create an LDAP group map.

Before you begin

  • A running LDAP server is configured with group mapping.

Follow these steps to configure an LDAP group map on the Cisco APIC:

Procedure

  1. On the menu bar, choose Admin > AAA.

  2. In the Navigation pane, choose Authentication.

  3. In the Work pane, choose LDAP Group Maps > LDAP Group Maps.

  4. Click Actions> Create LDAP Group Map.

  5. In the Create LDAP Group Map screen that is displayed, specify the Type, Group Map Name, Description (optional), and choose an LDAP Group Map Rule by clicking Add LDAP Group Map Rule.

    If an LDAP Group Map Rule is not available, click Create LDAP Group Map Rule. For the detailed procedure about creating LDAP group map rules, see the Configuring LDAP Group Map Rules procedure.

  6. Click Save.

The LDAP group map is created and configured on the Cisco APIC.